new flash player security release problems (10.0.32.18)

[nak5ive]

With the recent update of firefox, the new security release of flash player plugin 10.0.32.18 was recommended as well. After updating my flash player, all movies i had built within Flash CS3 (in AS3) lost the ability to use LocalConnection. This break in functionality is ONLY apparent on my Mac (LocalConnection still works in Windows). After doing quite a bit of reading about this security release and what it entails, it's apparent that a large portion of it was dedicated to changing the API for LocalConnection in the OS X environment. Their docs state that a new variable of LocalConnection.isPerUser was introduced to the api for backwards compatibility reasons, however since CS3 only compiles to Flash 9, I can't use it.

In short, the security release was not supposed to break older flash movies, and even states that it will still work with AS2 apps. however, any LocalConnection objects published from CS3 to Flash 9 format will not work on my Mac.

I am currently running Snow Leopard (OS X 10.6), flash player plugin 10.0.32.18, CS3 dev environment.

Does anyone have experience with this bug?

***Update
Here is a link to the adobe technote following this security release:
http://kb2.adobe.com/cps/497/cpsid_49735.html

[RogerClark]

nak5ive

I have some stuff that uses the localConnection on Mac, and I've just installed the latest Flash player running on Leopard and it has broken my site :-(

The reason I was using Local Connection was because I had to load AS2 swfs inside an AS3 container, and the AS3 -> AS2 interaction does not work, despite what Adobe's doc's say.
So the only workable solution is to use the LocalConnection.

I'm using the free Flex SDK, which appears to support all the Flash 10 API's, but I don't think its worth me fixing the site using the new API's.

I'll just have to drop the loading of AS2 SWF's inside of AS3. The whole lot will have to be AS3. :-(

[henke37]

Uhm, the docs says it doesn't work.

[wvxvw]

You can do iy like this:

if (Capabilities.version.match(/10./g))
{
LocalConnection["isPerUser"] = true;
}

Looks bad, but should work...

And if you need a solution for AS2 to AS3 without use of LocalConnection, you can look here:
http://code.google.com/p/e4xu/source...ge/EIBridge.as
This code isn't yet complete, requires some documentation and the AS2 part, but, if you'll get an idea, you may implement that yourself as well, shouldn't be difficult. I just hadn't had time to finish it.

[nak5ive]

Originally Posted by henke37

Uhm, the docs says it doesn't work.

i'm not sure what you mean by "it doesn't work". what does "it" refer to?

in any case, i will attempt wvxvw's method to see if the movie will still compile in the CS3 environment. but wouln't the syntax be more along the lines of:

var myLC:LocalConnection = new LocalConnection();

if (Capabilities.version.match(/^MAC 10\,/g))
{
    myLC.isPerUser = true;
}

I'm having a hard time believing this will actually solve any problems anyway. The isPerUser variable just allows/dissallows the connection to be made across user accounts. I'm finding that with the most recent release, no connections are even being made on OS X (10.6)

Let me also clarify that i'm not using any AS2 movies at all. i'm only using AS3 in my apps. so interaction between the two versions is not my focus. it is interesting to see that other people have not encountered this issue yet.

[nak5ive]

CS3 barks at me when i try that script. i can't use an undefined property "isPerUser" in CS3 dev environment. Anyone got any ideas?

[wvxvw]

Sorry for my clumpsy regexp, it should have really been like this: /\D+10\./
But this code must be like I put it:

myLC["isPerUser"]

This way you "mask" this code from compiler, so, it won't make compile-time checking. But, when you will run this SWF in FP10, it will call the correct method, but you have to prevent this code from running in FP9 (by checking the player version via regexp), where LocalConnection class doesn't have isPerUser method.

[RogerClark]

wvxvw,

Thanks for the tip about the e4xu project on Google code.

I've had a quick look at the code and it uses LocalConnection, i.e have classes that inherit from LocalConnection, so I wonder if e4xu is immune to this change to the security model or not.

If its just a one line-er in the code by setting myLC["isPerUser"]=true, then I may as well give that a try first.

I'm using the latest Flex SDK compiler (using FlashDevelop) as the IDE, so I think that it should recognise the PerUser property, but if not I can use myLC["isPerUser"] to hide the property access until runtime.

[RogerClark]

Just a thought, but has anyone tried this new code on the Flash 9 player or the 10 Player before the security update ?

is the "isPerUser" a new property of LocalConnection or was it there in Flash 9

i.e.

myLC["isPerUser"]=true;

going to give runtime errors on Flash 9 etc if isPerUser is not defined?

[wvxvw]

Nope, this property doesn't exist in FP9.

I haven't updated it yet to use this feature. Also, I cannot test it on Mac to prove it's working... I'll try to see what I can do... need to read the new docs... and, actually I was looking into other ways of communicating between 2 SWFs. ExternalInterface is on the way and SharedObject is yet to try...